[Freeswitch-users] Been hacked - what's the best way to prevent sip scanner?

[Tony Graziano]

Depends on your config. If the attack is vicious enough, the best defense it
to block it upstream, if possible.

I always put my servers behind firewalls, but that's me.

My firewall is helpful in that is limits the connections per second from any
ip address. This is not something that can be helpful if the attack is
distributed though.

There are some good scripts out there to help identify a potential attack
and help alert your firewall, etc.



On Tue, Oct 5, 2010 at 2:55 PM, Mario <mario_fs at mgtech.com> wrote:

> After working 4 hours I found that FS was hosed due to someone from
> 208.109.87.234 sending tons of traffic to FS. I blocked the IP address.
> Not only did it overload the connection but stopped FS from working,
> meaning no phones. This had not happened with the SPA9000. I listed on
> on a FS conference call discussing this issue. Is there someplace that
> has a list of things to do to prevent/reduce this? I did have ports,
> etc. blocked in the firewall. Thanks. Mario
>
> _______________________________________________
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>



-- 
======================
Tony Graziano, Manager
Telephone: 434.984.8430
sip: tgraziano at voice.myitdepartment.net
Fax: 434.984.8431

Email: tgraziano at myitdepartment.net

LAN/Telephony/Security and Control Systems Helpdesk:
Telephone: 434.984.8426
sip: helpdesk at voice.myitdepartment.net
Fax: 434.984.8427

Helpdesk Contract Customers:
http://www.myitdepartment.net/gethelp/

Why do mathematicians always confuse Halloween and Christmas?
Because 31 Oct = 25 Dec.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20101005/4f92dc50/attachment.html